Report: NSA Mimics Google to Monitor "Target" Web Users

page: 1
11

log in

join

posted on Sep, 13 2013 @ 12:23 PM
link   
Report: NSA Mimics Google to Monitor "Target" Web Users


I'm not sure if you guys are listening to Steve Gibsons Security Now Podcast you should because he talks about this very vulnerability in detail. Here's a transcript.



However it seems that the NSA has figured out how to use MITM aka Man In The Middle attacks to spy on people.

So the bad news folks is that none of your online communication is safe. Even if you used a secure vpn connection they could spoof the website you wanted to visit and capture your login information. And you'd be none the wiser. This is certainly a violation of the law by the NSA. Though they won't ever be convicted of breakign any laws.

My advice to people is to make sure that the websites your connecting to and their corresponding ip addresses match.


Buried in a Brazilian television report on Sunday was the disclosure that the NSA has impersonated Google and possibly other major internet sites in order to intercept, store, and read supposedly secure online communications. The spy agency accomplishes this using what's known as a "man-in-the-middle (MITM) attack," a fairly well-known exploit used by elite hackers. This revelation adds to the growing list of ways that the NSA is believed to snoop on ostensibly private online conversations.

In what appears to be a slide taken from an NSA presentation that also contains some GCHQ slides, the agency describes "how the attack was done" on "target" Google users. According to the document, NSA employees log into an internet router—most likely one used by an internet service provider or a backbone network. (It's not clear whether this was done with the permission or knowledge of the router's owner.) Once logged in, the NSA redirects the "target traffic" to an "MITM," a site that acts as a stealthy intermediary, harvesting communications before forwarding them to their intended destination.

Advertise on MotherJones.com

The brilliance of an MITM attack is that it defeats encryption without actually needing to crack any code. If you visit an impostor version of your bank's website, for example, the NSA could harvest your login and password, use that information to establish a secure connection with your real bank, and feed you the resulting account information—all without you knowing.




Report: NSA Mimics Google to Monitor "Target" Web Users
edit on 13-9-2013 by grey580 because: (no reason given)




posted on Sep, 13 2013 @ 12:26 PM
link   
reply to post by grey580
 


I abandoned google a while back .. startpage.com... is my go-to search engine.. it actually acts like a proxy to google, it takes your search request, queries google for you and presents the results..

So you get the accuracy of google without actually using google.



posted on Sep, 13 2013 @ 12:31 PM
link   
reply to post by miniatus
 


And that would do nothing to stop a MITM attack.
They could tap a router along the way and spoof the website you are using.

As far as you could tell you'd be using the website you intended to use but would be using one run by the NSA.



posted on Sep, 13 2013 @ 12:33 PM
link   

grey580
reply to post by miniatus
 


And that would do nothing to stop a MITM attack.
They could tap a router along the way and spoof the website you are using.

As far as you could tell you'd be using the website you intended to use but would be using one run by the NSA.


Yeah I'm familiar with MTM attacks, they've been around for decades.. since they are in bed with many of the tier 1 providers there's really no way to avoid it. They also apparently have mastered decrypting most major encryption standards.



posted on Sep, 13 2013 @ 12:35 PM
link   
reply to post by grey580
 


I actually use MTM attacks against myself as a programmer to reverse engineer protocols
I got sued by AOL back in the day for an AI chat bot I wrote using that very thing.. those were the days lol



posted on Sep, 13 2013 @ 12:35 PM
link   
How did they think they would get away with this.

Apparently, The Amash Admendment will be voted on again in the House.

Congress needs to defund this runaway Agency.



posted on Sep, 13 2013 @ 12:37 PM
link   

whyamIhere
How did they think they would get away with this.

Apparently, The Amash Admendment will be voted on again in the House.

Congress needs to defund this runaway Agency.



This is why I do hail Snowden as a hero.. this kind of thing has been going on for a long time now, it took him to bring it to the public eye .. and now the government is just hoping this goes away.. the best thing that could happen is that stories keep coming out and the public constantly is aware of it.. the heat should not let off.



posted on Sep, 13 2013 @ 01:16 PM
link   
reply to post by grey580
 


hmmmm...
could this be used on say,...

a conspiracy forum and make fake posts in a members name?

I've seen a few well known members do flip-flops regarding their position on certain issues
quite a bit lately


but feel free to disregard my words, as I Am quite "Insane".



posted on Sep, 13 2013 @ 01:29 PM
link   
reply to post by TheMagus
 


It certainly could be used to gather login information.
And then post as people.

hrmmmm..... a posting notification feature could be handy on this site.
Or an authenticate computer to post feature.



posted on Sep, 13 2013 @ 02:28 PM
link   
reply to post by miniatus
 

This comes as no surprise what so ever to me.I wonder,if they intercept+read like this,can they also pretend to be the person you're corresponding with?



posted on Sep, 13 2013 @ 02:43 PM
link   

miniatus
reply to post by grey580
 


I abandoned google a while back .. startpage.com... is my go-to search engine.. it actually acts like a proxy to google, it takes your search request, queries google for you and presents the results..

So you get the accuracy of google without actually using google.



Although I hate the name, I prefer www.duckduckgo.com... It absolute stores NO information about it's users. And the results are highly comparable to Google!


- SN



posted on Sep, 13 2013 @ 02:54 PM
link   
Man in the middle attacks are great for easily defeating PKI (public key infrastructure) as its based on trust so once you can break that trust as the first time you think you are connecting to www.google.com its actually connecting you to pki.nsa.gov and the initial key exchanges will then occur and at that point they'll be able to decode anything you send so they then pretend again to be you since they don't have to have your real keys just a fake one for the final step as its will be you--nsa--unencrypted- nsa- actual website

now it takes some preparation to pull it off but once its done its free data to those at the NSA with no need to spend any more effort trying to decode it



posted on Sep, 13 2013 @ 02:56 PM
link   
reply to post by SadistNocturne
 


Again.

That would do nothing in this situation.

The NSA can duplicate duckduckgo and trick you into thinking that you're on that site while they monitor your searches.



posted on Sep, 13 2013 @ 03:26 PM
link   

grey580
reply to post by TheMagus
 


It certainly could be used to gather login information.
And then post as people.

hrmmmm..... a posting notification feature could be handy on this site.
Or an authenticate computer to post feature.


maybe I'm being paranoid....
Being asked for suthentication if i use the black theme
www.abovetopsecret.com...



posted on Sep, 13 2013 @ 03:31 PM
link   
reply to post by grey580
 


Google defaults to an https connection, so I don't think that a MitM exploit is going to do them much good. Spoofing DNS to re-route you to a fake Google site is possible, but I'd say very difficult and messy unless you were after select individuals.



posted on Sep, 13 2013 @ 03:35 PM
link   

adjensen
reply to post by grey580
 


Google defaults to an https connection, so I don't think that a MitM exploit is going to do them much good. Spoofing DNS to re-route you to a fake Google site is possible, but I'd say very difficult and messy unless you were after select individuals.



Please please please please read the article.

They go into explaining how they did what you think they could not do. HTTPS SSL certificates can be spoofed.


And if you want your mind blown watch the video. Steve Gibson goes into detail on how it's done.



posted on Sep, 13 2013 @ 03:39 PM
link   

miniatus
This is why I do hail Snowden as a hero.. this kind of thing has been going on for a long time now, it took him to bring it to the public eye .. and now the government is just hoping this goes away.. the best thing that could happen is that stories keep coming out and the public constantly is aware of it.. the heat should not let off.


Ok, time to throw my two bits in...

Whereas I totally love what he did...I kinda questioned everything *about* him the minute I heard his background.

Everybody booed the idea that a HS dropout could make it into being employed by Booz, Allen & Hamilton. I laughed at this, as I myself was employed by BAH back in 2001, and I myself am a HS dropout. So, there 8-P....

But what didn't make sense, was the amount of his salary when viewed in context of his experience.

Apparently he had *some* college experience. As did I, 45 credits with a 3.9 GPA, personally speaking. But, he is a general OS / networking guy...writing scripts doesn't get you $250K a year. I had about eight years experience at the time as a database developer (writing complex SQL oriented programs to mine data for business purposes [such as Payroll, HR, Finances, Supply Chain Management, etc]) specializing in a software that is not something you can simply "get" to piddle around with and figure out on your own. You had to be trained by a big six consulting firm and at that time it meant taking classes from the company that wrote the software I specialize in. When I heard he was making $250K, I almost laughed...because I was making $105K at the time. Comparing his apparent skillset to mine, weighing in the factor that hey maybe he is some uber god at what he does, I just couldn't see how he could be making that kind of dough.

Also, whereas BAH isn't the CIA and doesn't have the crazy security protocols that an alphabet agency does, his story about snatching drives and loading up thumb drives seems a bit contrived to me. I could be wrong, but it still seems to be a bit much. My average contract through BAH is represented by one where I was at Bolling AFB in DC on a contract we had with the DOD. Security out the wazoo. Metal detectors. Flashing green lights on the ceilings to let you know if someone that was unsecured was walking into the room so as to watch what you were talking about for fear they might hear you. And a contract like that, you don't just walk off with drives, thumb or hard variety.

Now, let's talk about his going into the military for some kind of seal training or whatever he supposedly did. He broke his legs. They dropped him out of the military for that ? Huh ? What? Of ALL the military folks I know, this is unheard of.

Then, he just waltzes into the CIA and gets a job ? Umm....maybe POSSIBLY if he was someone's nephew or cousin...possibly....but, unlikely. Particularly with no HS or Uny degree. Alphabet agencies are STICKLERS on that. And ANAL ones at that.

[And lets hold off on the fact that he still needed to go through the background /security clearance check, we'll talk about that in a moment]

Then, he gets (of all the choice assignments) Hawaii as a base of operations from BAH ? Now, that's not to say that BAH doesn't do business in Hawaii. Most big six consulting firms simply want you to live near a major airport and could care less about it beyond that. But he was *assigned* to a contract gig in Hawaii? For the NSA ? Ok, it takes FOREVER to get cleared for your TS/Poly clearance, which I cannot see anyone working at an NSA facility without having. Christ, I implemented software applications for the NSA and they wouldn't even let me onto the property because my wife was from the UK, I # you not. I had to do all of my work remotely. He lands this hellaciously fantastic gig, with an awesome and unfounded salary, waltzes through the security check, and then simply walks out of their NOC with thumb and hard drives full of information?

I worked for a firm in 1999/2000 that had bio scan technology at the entrance to the NOC facilities. Not to mention at the vast majority of these kinds of installations you are video taped and usually physically (guard standing there watching) observed as you come and go.

To give you an idea what working in a TS environment was like back in the early 2000's while waiting for clearance. You couldn't walk anywhere without supervision. Couldn't go to the john, couldn't get coffee, go for a smoke, etc without an escort. If you needed something printed, you had to put the documents on a floppy disk and hand it to someone who would then print it out for you, and guess what? You wouldn't even get your floppy returned for fear you had a small program on it that would raid the RAM in the printer and snatch other print jobs onto the floppy...

Why did I tell you all that just now? Because it can take YEARS (particularly so now) to get a clearance. At the time (around 2000) it took me over a year and I still never was granted a TS clearance. Now, maybe he got an initial clearance (say, a secret clearance) in the military. That doesn't mean making the leap from Secret to Top Secret is a cakewalk...I can point you to many, many folks who found out quite the opposite...and, you have to have damned good reason to go from Secret to Top Secret, usually it's a graduated process...step by step, especially if you didn't need the god level clearance to begin with when first applying....


So yeah, I have issues with this guys story. Suffice it to say, I think it's more of a PR / propaganda job designed to let us, ALL of US (around the world) know exactly how much power the US Gov't has.

Flame me all you want, these are just my thoughts based off of my own experiences in the same fields that our boy Ed was playing in....


- SN
edit on 13-9-2013 by SadistNocturne because: Forgot to mention the little guy didn't necessarily have his TS clearance before "going into the CIA"....



posted on Sep, 14 2013 @ 11:08 AM
link   

grey580
reply to post by SadistNocturne
 


Again.

That would do nothing in this situation.

The NSA can duplicate duckduckgo and trick you into thinking that you're on that site while they monitor your searches.


I never said it wouldn't.

However, I do take solace that even under the power of the Evil Eye of Saurus officially known as NSA/Prism....they still have to take notice of you in the first place.

{TWERK} dance, baby dance!!! {/TWERK}


- SN
edit on 14-9-2013 by SadistNocturne because: Damn HTML editors!!!! To HELL with you devilspawn!!! Or, at least to BLEEEEEEEEP with you..he'll know what to do with you!!!





new topics
top topics
 
11

log in

join